ANALYSE / AMLA / AML/CFT / Fintech regulation / EU fintech / Crypto compliance

AMLA is reshaping EU anti-money-laundering supervision: what fintechs should prepare in 2026

EU AML/CFT responsibilities moved from the EBA to AMLA, a common methodology is being built, and direct supervision starts in 2028.

On 1 January 2026, EU-level AML/CFT mandates and functions moved from the European Banking Authority to the new Anti-Money Laundering Authority, AMLA. Existing EBA guidelines and standards remain in force until AMLA replaces them. The change therefore does not erase the previous framework overnight; it moves the market toward a more integrated European supervisory system.

What is happening between 2026 and 2028

  • AMLA is developing the Single Rulebook and a common AML/CFT risk-assessment methodology;
  • authorities and selected market participants are testing the data and selection framework in 2026;
  • the first selection exercise for direct supervision is planned for 2027;
  • from 2028, AMLA is expected to directly supervise 40 of the EU's most complex high-risk financial institutions or groups.

Published criteria focus direct supervision on large cross-border organisations with a high residual-risk profile. Firms outside the first group of 40 will still feel the effects through common standards, national supervisors, partner due diligence and bank expectations.

What fintech and crypto firms should review

  1. Risk assessment. Are customers, products, channels and geographies connected to specific controls rather than only a generic score?
  2. Data lineage. Can the firm explain the origin of metrics, monitoring decisions and management information?
  3. Group view. Can the group see risk across entities, branches and freedom-to-provide-services activity?
  4. Governance. Is ownership of risk acceptance, alert closure and board reporting clear?
  5. Outsourcing. Does the firm retain control of KYC, screening and monitoring when using a vendor?
  6. Evidence. Do policy, system configuration, file samples and staff actions match?

For a licence applicant, this increases the value of one coherent file: ownership, source of funds, the AML framework, product flows, transaction monitoring and banking narrative should not conflict. CrystalCore connects these workstreams through KYB/KYC support and financial and crypto licensing.

Does every firm need to submit data to AMLA now?

No. National supervisors organise the 2026 data collection for relevant firms, while AMLA provides the reporting package and guidance. A firm receiving a request should follow its supervisor's instructions. Without a request, the useful action is to validate data readiness and the group-wide risk view, not to send an unsolicited submission.

Sources

Reviewed on 10 October 2026. Specific duties depend on the firm's status, services, countries and competent-authority instructions.

Envoyer une demande